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cooperative action of a plurality of subsystems that act as a client apparatus, such as the 
motor control ECU 322, the reactive gas supply control ECU 323, the electrical power 
distribution control ECU 324, and the cell voltage detection control ECU 325. 

Here, each of the ECUs 322, . . 325 that form each subsystem carry out control 
for I/O processing for control signals sent and received between the cooperative control 
ECU 321 and the controlled objects and the shut down and protective operations during 
the occurrence of an abnormality such as a network stoppage, and based on the control 
signal obtained by the I/O processing of each of the ECUs 322, . . 325, carries out the 
control operations for controlling each of the ECUs 322, . . ., 325. 

As shown in Fig. 3, for example, the cooperative control ECU 321 is formed 
comprising an MPU 361, a communication controller 362, and a program writing control 
unit 363. 

The MPU 361 receives each of the control signals after I/O processing from 
each of the ECUs 322, 325 that act as a plurality of subsystems via the 
communication controller 362, and carries out the control operations for cooperatively 
operating each of the ECUs 322, . . 325 based on these control signals. Furthermore, 
the MPU 361 determines whether or not the communication with the network 151 
-comicctcd-te4he^commuriieation-^ntroHer-3^ is operating normally, and at the same 
time, detects communication traffic, and based on the results of these determinations and 
the results of the detection, carries out switching control of the communication paths as 
will be described below. 

In addition, the program writing control unit 363 controls the writing operation 
when the content or the like of the cooperative operation of each of the ECUs 322, 
325 is modified or the appropriate program writing apparatus 365 modifies the operation 
control of the MPU 361 externally. 
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communication system, the amount of partitioning of the data can be adjusted even 
between the normally operating communication systems, and can be set so that the 
communication traffic in each of the communicating systems will flow smoothly. 
Thereby, for example, delays in the transmission of data and the like due to the 
5 communication traffic of a particular communication system increasing excessively can 
be prevented. 

Moreover, in the present embodiment, when the communication path of the first 
data 380a is switched from a communication system 381 on which an abnormality has 
occurred to a normally operating communication system 381 or 383, in the normally 
10 operating communication systems 382 and 383, the communication traffic is set so as to 
flow smoothly, but it is not limited thereby, and for example, can be set so as to cause an 
unbalance in the communication traffic in each of the communication systems 382 and 
383, or, for example, can be set so that the communication traffic in any of the 
communication systems will increase. In sum, when switching the communication 
M= 15 path of the data from a communication system on which an abnormality has occurred to 
a normally operating communication system, it can be set so that transmission delays 
and the like due to the communication traffic excessively increasing do not exceed a 
predetermined permitted range. Moreover, the adjustment of the communication traffic 
in each of the communication systems 381, 382, and 383 can reflect the predetermined 
20 distribution rate set in advance, and for example, distributed such that the current 
communication traffic is detected and allocated so as not to exceed a predetermined 
threshold. 

In addition, in the present embodiment, the three cooperative control side 
communication ports 321 A, 321B and 321C are connected to the communication 
25 joef»stter3fi3=©f the cooperative control ECU 32 1 , but it is not limited thereby, and can 
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be connected to four or more cooperative control side communication ports. For 
example, like the vehicle control system 390 according to the modified example of the 
present embodiment shown in Fig. 14, the two cooperative control side communication 
ports 321 A and 32 IB can be connected. 

In the vehicle control system 390 according to the modified example of the 



present embodiment shown in Fig?19, the two redundant cooperative control side 

communication ports 321 A and 321B are connected to the ^romunicationxoBfrefteg* 
362 -e f the cooperative control ECU 321. 

In addition, a plurality (for example, two each) of redundant communication 
ports 391 A and 391B and communication ports 392A and 392B are respectively 
connected to each of the communication controllers 372 of the plurality (for example, 
two) of the first and second ECUs 391 and 392 that act as subsystems. 

In addition, in the communication system 393 for example, one communication 
port 391 A of the first ECU 391 is connected via the communication path 393M to the 
first cooperative control side communication port 321 A of the cooperative control ECU 
321, while one communications port 392 A of the second ECU 392 is connected via the 
communication path 393S. 

Furthermore, in the communication system 394, the other communication port 
392B of the second ECU 392 is connected via the communication path 394M to the 
second cooperative control side communication port 32 IB of the cooperative control 
ECU 321, while the other communication port of the first ECU 39 IB is connected via 
the communication path 394S. 

Moreover, in Table 2, a summary of the communication paths selected 
respectively during the normal operation and when damage has occurred on network 151 
and the data that is sent and received is shown. 
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be connected to four or more cooperative control side communication ports. For 
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